PT-2026-26878 · WordPress · Neos Connector For Fakturama

Muhammad Afnaan · Published 2026-03-21 · Updated 2026-03-21 · CVE-2026-4143

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Neos Connector for Fakturama plugin for WordPress versions up to and including 0.0.14

Description The Neos Connector for Fakturama plugin for WordPress is susceptible to Cross-Site Request Forgery. This is a result of a lack of nonce validation in the ncff add plugin page() function, which manages settings updates. An unauthenticated attacker could potentially modify plugin settings by tricking a site administrator into performing an action, such as clicking a malicious link.

Recommendations Update the Neos Connector for Fakturama plugin to a version later than 0.0.14.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2026-4143

Affected Products

Neos Connector For Fakturama

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2026-4143 · Security Note
• https://twitter.com/VulmonFeeds/status/2035240875337379840 · Twitter Post
• https://plugins.trac.wordpress.org/browser/neos-connector-for-fakturama/trunk/neosconnectorforfakturama-admin.php#L231 · Note
• https://twitter.com/CVEnew/status/2035237240352407754 · Twitter Post
• https://plugins.trac.wordpress.org/browser/neos-connector-for-fakturama/trunk/neosconnectorforfakturama-admin.php#L223 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/d6ffc8de-e8e4-41b6-a4b9-79511fb950fc?source=cve · Note
• https://plugins.trac.wordpress.org/browser/neos-connector-for-fakturama/tags/0.0.14/neosconnectorforfakturama-admin.php#L231 · Note
• https://plugins.trac.wordpress.org/browser/neos-connector-for-fakturama/tags/0.0.14/neosconnectorforfakturama-admin.php#L223 · Note